[cloud] Add ability to retrieve Google Compute Engine metadata

For some unspecified "security" reason, the Google Compute Engine
metadata server will refuse any requests that do not include the
non-standard HTTP header "Metadata-Flavor: Google".

Attempt to autodetect such requests (by comparing the hostname against
"metadata.google.internal"), and add the "Metadata-Flavor: Google"
header if applicable.

Enable this feature in the CONFIG=cloud build, and include a sample
embedded script allowing iPXE to boot from a script configured as
metadata via e.g.

  # Create shared boot image
  make bin/ipxe.usb CONFIG=cloud EMBED=config/cloud/gce.ipxe

  # Configure per-instance boot script
  gcloud compute instances add-metadata <instance> \
         --metadata-from-file ipxeboot=boot.ipxe

Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2017-01-23 14:41:22 +00:00
parent 0dc4814ca8
commit de85336abb
5 changed files with 87 additions and 0 deletions

View File

@@ -0,0 +1,7 @@
#!ipxe
echo Google Compute Engine - iPXE boot via metadata
ifstat ||
dhcp ||
route ||
chain -ar http://metadata.google.internal/computeMetadata/v1/instance/attributes/ipxeboot

View File

@@ -0,0 +1,4 @@
/* Allow retrieval of metadata (such as an iPXE boot script) from
* Google Compute Engine metadata server.
*/
#define HTTP_HACK_GCE

View File

@@ -43,3 +43,6 @@ REQUIRE_OBJECT ( httpdigest );
#ifdef HTTP_ENC_PEERDIST
REQUIRE_OBJECT ( peerdist );
#endif
#ifdef HTTP_HACK_GCE
REQUIRE_OBJECT ( httpgce );
#endif

View File

@@ -78,6 +78,7 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
#define HTTP_AUTH_BASIC /* Basic authentication */
#define HTTP_AUTH_DIGEST /* Digest authentication */
//#define HTTP_ENC_PEERDIST /* PeerDist content encoding */
//#define HTTP_HACK_GCE /* Google Compute Engine hacks */
/*
* 802.11 cryptosystems and handshaking protocols